A talk, a summary article, and a related paper by Zhiyun Qian et al. about overwriting slab objects containing a
struct page * field to achieve arbitrary read/write in physical memory.The authors also shared a set of exploits that uses the described technique.